Medium severity6.5NVD Advisory· Published Jul 20, 2026· Updated Jul 20, 2026

CVE-2026-12898

Description

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory.

Affected products

WordPress/All-in-One WP Migration and Backupllm-fuzzy
Range: <7.106

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/c90553e4-8e1a-4c99-a28f-a0de8d635caa/nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000